Just nu i M3-nätverket
Jump to content

VBS: Malware-gen och WIN32: Trojan-Gen


crakel

Recommended Posts

Hej!

 

Jag tycks ha fått två virus som Avast inte tycks kunna åtgärda.

Jag har fått följande meddelande:

 

C:\Documents and Settings\Kral\Lokala inställningar\Temp\tt2.tmp.vbs

is infected by VBS: Malware-Gen

 

C:\WINDOWS\System32\trza.tmp

is infected by

WIN32:Trojan-Gen (other)

 

Jag har försökt flytta de till "chest", men de tycks inte försvinna, och vid senaste försök tycks det varken gå att flytta, radera eller reparera filerna.

 

Det enda program jag har är Avast! Känner inte till vad övrigt som finns på marknaden.

 

Hur går jag tillväga för att reparera detta, vilka program behöver jag, och är det riskfritt att gå ut på internet för att hämta dessa eventuella program. Nu använder jag en annan dator i väntan på besked. Jag har inte säkerhetskopior på alla viktiga filer.

 

Tack på förhand!

 

MVH

Carl

 

Link to comment
Share on other sites

Ladda hem och kör en scan med Superantispyware free edition

http://superantispyware.com/download.html

Klicka på Check for updates,sedan Nästa,bocka i C:\Fixed Drive

välj därefter Perform Complete Scan....

 

När scanningen är klar välj Preferences>Statistics/Logs markera loggen,

klicka sedan på View Log,spara loggen som kommer upp,skicka hit den

 

Tryck på LOG-knappen i besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen

 

[inlägget ändrat 2008-08-26 13:36:50 av Brynäsarn]

Link to comment
Share on other sites

Jag googlar på superantispyware och får väldigt blandade omdömen, huvudsakligen tveksamma och negativa. Det ser onekligen inte helt seriöst ut heller. Är det verkligen ett bra program? Vill bara vara säker på vad det är jag laddar ner...

 

Link to comment
Share on other sites

SUPERAntiSpyware är ett seriöst program.

Däremot så vet jag inte om det hjälper mot de infektioner du har.

 

Vi kan se om HijackThis visar något till att börja med:

http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Installera, starta och välj "Do a system scan and save a logfile", kopiera loggen som kommer upp (inget annat).

 

I ditt svar bifogar du HijackThis-loggen på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen

 

Link to comment
Share on other sites

Försöker gå in på både trendsecure och superantispyware, men just dessa sidor går inte att komma in på... Har inga problem med att gå in på exempelvis google eller andra sidor, men just dessa två...

 

Link to comment
Share on other sites

Du har någon skadlighet i datorn som förhindrar vissa webbsidor.

 

Om det är XP så ladda ner SDFix till Skrivbordet:

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Dubbelklicka på SDFix.exe och en ny mapp skapas, C:\SDFix.

 

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

 

Öppna den nya mappen C:\SDFix och dubbelklicka på RunThis.bat för att starta programmet.

Tryck Y för att fortsätta.

Det arbetar ett tag och när det är klart så kommer det upp en fråga om du vill starta om datorn.

Tryck på godtycklig tangent för att omstarten ska påbörjas.

Datorn kommer att ta lång tid på sig under uppstarten eftersom programmet kommer att gå igång och fixa till en massa.

När det är klart visas Finished.

Tryck på valfri tangent för att avsluta programmet.

 

Öppna mappen SDFix och öppna filen Report.txt i Anteckningar.

Klistra in innehållet i filen i ditt svar här.

 

Se om det går bättre att hämta hem HijackThis nu.

 

Link to comment
Share on other sites

Lyckades ta hem SDFix, och har kört det - här kommer logen. Ska försöka ta hem Hijackthis nu!...

 

[log]

SDFix: Version 1.219

Run by Administrat”r on 2008-08-27 at 11:47

 

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

 

Checking Services :

 

Name :

sysrest.sys

 

Path :

\??\C:\WINDOWS\system32\sysrest.sys

 

sysrest.sys - Deleted

 

 

 

Restoring Default Security Values

Restoring Default Hosts File

Restoring Default Desktop Wallpaper

Restoring Default ScreenSaver value

 

Rebooting

 

 

Checking Files :

 

Trojan Files Found:

 

C:\WINDOWS\system32\lphc7gcj0e5t9.exe - Deleted

C:\WINDOWS\system32\phc7gcj0e5t9.bmp - Deleted

C:\WINDOWS\system32\blphc7gcj0e5t9.scr - Deleted

C:\WINDOWS\system32\a.exe - Deleted

C:\WINDOWS\system32\sysrest32.exe - Deleted

C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted

C:\WINDOWS\system32\sysrest.sys - Deleted

C:\WINDOWS\system32\tdssadw.dll - Deleted

C:\WINDOWS\system32\tdssinit.dll - Deleted

C:\WINDOWS\system32\tdssl.dll - Deleted

C:\WINDOWS\system32\tdsslog.dll - Deleted

C:\WINDOWS\system32\tdssmain.dll - Deleted

C:\WINDOWS\system32\tdssservers.dat - Deleted

 

 

 

Folder C:\Documents and Settings\Kral\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed

 

 

Removing Temp Files

 

ADS Check :

 

 

 

Final Check :

 

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-27 12:03:21

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden services & system hive ...

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bb5c7a53]

"ImagePath"="\SystemRoot\System32\drivers\bb5c7a53.sys"

"Type"=dword:00000001

"Start"=dword:00000001

"ErrorControl"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s0"=dword:0ec5d19a

"s1"=dword:79e78ffc

"s2"=dword:cbfbe7ef

"h0"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:aa,43,0a,6b,51,58,dd,71,b5,1c,ea,5f,63,ee,69,b7,4d,f1,7b,2d,2f,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,72,6c,a3,74,1b,21,c9,9e,d6,79,62,c8,72,ec,ac,a1,c4,..

"khjeh"=hex:84,b9,83,70,07,ab,92,ac,71,51,69,5a,7d,d6,50,1d,82,64,e5,70,13,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:ef,36,15,1c,0f,8c,ac,51,83,dd,6d,e1,82,83,9b,31,d0,09,f0,6c,2a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv]

"start"=dword:00000001

"type"=dword:00000001

"imagepath"=str(2):"\systemroot\system32\drivers\tdssserv.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\bb5c7a53]

"ImagePath"="\SystemRoot\System32\drivers\bb5c7a53.sys"

"Type"=dword:00000001

"Start"=dword:00000001

"ErrorControl"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:aa,43,0a,6b,51,58,dd,71,b5,1c,ea,5f,63,ee,69,b7,4d,f1,7b,2d,2f,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,72,6c,a3,74,1b,21,c9,9e,d6,79,62,c8,72,ec,ac,a1,c4,..

"khjeh"=hex:84,b9,83,70,07,ab,92,ac,71,51,69,5a,7d,d6,50,1d,82,64,e5,70,13,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:ef,36,15,1c,0f,8c,ac,51,83,dd,6d,e1,82,83,9b,31,d0,09,f0,6c,2a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv]

"start"=dword:00000001

"type"=dword:00000001

"imagepath"=str(2):"\systemroot\system32\drivers\tdssserv.sys"

 

scanning hidden registry entries ...

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]

"TracesProcessed"=dword:00000172

 

scanning hidden files ...

 

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

 

 

Remaining Services :

 

 

 

 

Authorized Application Key Export:

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program\\Messenger\\msmsgs.exe"="C:\\Program\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\\Program\\MSN Messenger\\msnmsgr.exe"="C:\\Program\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

"C:\\Documents and Settings\\Kral\\Skrivbord\\utorrent.exe"="C:\\Documents and Settings\\Kral\\Skrivbord\\utorrent.exe:*:Enabled:æTorrent"

"C:\\Program\\Soulseek\\slsk.exe"="C:\\Program\\Soulseek\\slsk.exe:*:Enabled:SoulSeek"

"C:\\Program\\Mozilla Firefox\\firefox.exe"="C:\\Program\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"

"C:\\Program\\Winamp Remote\\bin\\Orb.exe"="C:\\Program\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"

"C:\\Program\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"

"C:\\Program\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

"C:\\Program\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

"C:\\Program\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"

"C:\\Program\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

"C:\\Program\\Skype\\Phone\\Skype.exe"="C:\\Program\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "

"C:\\WINDOWS\\system32\\a.exe"="C:\\WINDOWS\\system32\\a.exe:*:Disabled:a"

"C:\\Documents and Settings\\Kral\\Lokala inst„llningar\\Temp\\.tt11.tmp"="C:\\Documents and Settings\\Kral\\Lokala inst„llningar\\Temp\\.tt11.tmp:*:Enabled:enable"

"C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system32\\sysrest32.exe:*:Enabled:enable"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program\\MSN Messenger\\msnmsgr.exe"="C:\\Program\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

 

Remaining Files :

 

 

File Backups: - C:\SDFix\backups\backups.zip

 

Files with Hidden Attributes :

 

Mon 19 Dec 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Sat 13 Jan 2007 32,256 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL0033.tmp"

Sat 13 Jan 2007 34,304 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL0475.tmp"

Sat 13 Jan 2007 32,256 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL0572.tmp"

Sat 13 Jan 2007 35,840 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL0593.tmp"

Sat 13 Jan 2007 35,328 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL0743.tmp"

Sat 13 Jan 2007 36,864 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL1490.tmp"

Sat 13 Jan 2007 33,792 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL1586.tmp"

Sat 13 Jan 2007 33,792 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL1629.tmp"

Sat 13 Jan 2007 37,376 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL1637.tmp"

Sat 13 Jan 2007 35,328 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL1718.tmp"

Sat 13 Jan 2007 37,888 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL1987.tmp"

Sat 13 Jan 2007 34,816 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2007.tmp"

Sat 13 Jan 2007 25,600 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2055.tmp"

Sat 13 Jan 2007 34,816 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2233.tmp"

Sat 13 Jan 2007 24,064 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2270.tmp"

Sat 13 Jan 2007 34,816 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2482.tmp"

Sat 13 Jan 2007 25,600 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2685.tmp"

Sat 13 Jan 2007 35,840 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2757.tmp"

Sat 13 Jan 2007 34,816 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2820.tmp"

Sat 13 Jan 2007 36,864 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL2827.tmp"

Sat 13 Jan 2007 25,088 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL3434.tmp"

Sat 13 Jan 2007 35,328 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL3568.tmp"

Sat 13 Jan 2007 35,840 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL3677.tmp"

Sat 13 Jan 2007 24,064 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL3694.tmp"

Sat 13 Jan 2007 37,376 ...H. --- "C:\Documents and Settings\Kral\Mina dokument\~WRL3834.tmp"

Thu 13 Mar 2008 47,104 ...H. --- "C:\Documents and Settings\Kral\Skrivbord\~WRL0002.tmp"

Thu 13 Mar 2008 47,104 ...H. --- "C:\Documents and Settings\Kral\Skrivbord\~WRL0004.tmp"

Thu 13 Mar 2008 47,616 ...H. --- "C:\Documents and Settings\Kral\Skrivbord\~WRL0333.tmp"

Thu 13 Mar 2008 47,616 ...H. --- "C:\Documents and Settings\Kral\Skrivbord\~WRL2648.tmp"

Thu 13 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b04031f0b83ee952189dd8beb4ee929a\BIT492.tmp"

Tue 11 Mar 2008 14,469,320 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e594db7af5e5210753dca7df77940605\BIT4ED.tmp"

Sat 10 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e86f7f947cc9f2c261146c045cde1616\BIT1.tmp"

Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\Kral\Application Data\U3\temp\Launchpad Removal.exe"

Thu 11 Jan 2007 61,440 A..H. --- "C:\Documents and Settings\Kral\Mina dokument\Vetenskap & Studier\Teatervetenskap 1-80\litter„r estetik\~WRL0448.tmp"

 

Finished!

 

[/log]

 

Link to comment
Share on other sites

Och här kommer loggen från HJT:

 

[log]Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:16:37, on 2008-08-27

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\LightScribe\LSSrvc.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program\Alwil Software\Avast4\ashMaiSv.exe

C:\Program\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\notepad.exe

C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program\Synaptics\SynTP\SynTPLpr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\Program\HP\HP Software Update\HPWuSchd2.exe

C:\Program\QuickTime\qttask.exe

C:\Program\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program\HPQ\SHARED\HPQWMI.exe

C:\Program\Google\Gmail Notifier\gnotify.exe

C:\Program\DAEMON Tools\daemon.exe

C:\Program\ALWILS~1\Avast4\ashDisp.exe

C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\3\3Connect\AutoUpdateSrv.exe

C:\Program\Delade filer\Teleca Shared\Generic.exe

C:\Program\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Program\3\3Connect\Wilog.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.se/0SESVSE/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=493&clcid=0x041d

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\HPQ\Quick Launch Buttons\EabServr.exe /Start

O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [AutoTBar] C:\Program\HP\Digital Imaging\bin\AUTOTBAR.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')

O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Uppdateringsagent.lnk = ?

O8 - Extra context menu item: &Windows Live Search - res://C:\Program\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Öppna på ny flik i bakgrunden - res://C:\Program\Windows Live Toolbar\Components\sv-se\msntabres.dll.mui/229?7da6ff3935604ba79d92d2946ebc958a

O8 - Extra context menu item: Öppna på ny flik i förgrunden - res://C:\Program\Windows Live Toolbar\Components\sv-se\msntabres.dll.mui/230?7da6ff3935604ba79d92d2946ebc958a

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{D862CA80-FB59-4C04-9E08-43D1F5C3EF22}: NameServer = 80.251.192.244 80.251.192.245

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program\HPQ\SHARED\HPQWMI.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program\Delade filer\LightScribe\LSSrvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

 

--

End of file - 8755 bytes

[/log]

 

Link to comment
Share on other sites

"C:\\Documents and Settings\\Kral\\Skrivbord\\utorrent.exe"="C:\\Documents and Settings\\Kral\\Skrivbord\\utorrent.exe:*:Enabled:æTorrent"

Är det det riktiga uTorrent-programmet som du har på skrivbordet? För det finns också en skadlig fil som använder samma namn.

 

"C:\\Documents and Settings\\Kral\\Lokala inst„llningar\\Temp\\.tt11.tmp"="C:\\Documents and Settings\\Kral\\Lokala inst„llningar\\Temp\\.tt11.tmp:*:Enabled:enable"

"C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system3

2\\sysrest32.exe:*:Enabled:enable"

Ovanstående två filer ska förbjudas i brandväggen.

 

Ladda ner ComboFix till Skrivbordet:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

 

[log]Dra ur internetanslutningen och stäng av alla program du ser inklusive antivirusprogram, antispionprogram och brandvägg, alternativt starta om datorn i felsäkert läge.

Kör ComboFix och följ anvisningarna som visas.

 

VIKTIGT! Klicka inte på ComboFix-fönstret med musen när den körs annars kan den hänga upp sig.

 

När den är färdig så ska en logg komma upp, bifoga den till ditt svar. Kontrollera att antivirusprogram och brandvägg är igång innan du ansluter till internet.

 

Om du får problem med att komma ut på internet:

Kontrollpanelen - Nätverksanslutningar

högerklicka på din internetanslutning och välj Reparera och/eller starta om datorn.[/log]

 

Varning! ComboFix förhindrar automatisk körning av CD, disketter och USB-enheter för att göra det lättare att rensa datorn och skydda datorn mot infektioner i framtiden. Det kan bli problem t ex om datorn har internet via ett USB-modem eller USB-nätverkskort. Säg då till i stället för att köra ComboFix.

 

Link to comment
Share on other sites

Utorrent programmet på skrivbordet är det jag använder mig av, ja.

Behöver jag avinstallera det och installera det på nytt, eller vad är påpassligt att göra, för att bli av med den skadliga filen?

 

Dessutom är det tyvärr ett USB-modem jag använder (that is: mobilt bredband från 3). Hur gå tillväga isf?

 

MVH

Carl

 

Link to comment
Share on other sites

Då kan du låta uTorrent vara som den är. Den skadliga fil som använder samma namn fungerar inte som torrent-klient.

 

Ladda ner RSIT (random's system information tool) till Skrivbordet

http://images.malwareremoval.com/random/RSIT.exe

Starta programmet och klistra in loggen som kommer ut. Om den inte kommer upp automatiskt så finns den i mappen C:\rsit.

 

 

Link to comment
Share on other sites

Här kommer logen. Missade att förbjuda tidigare nämnda två filer från brandväggen, gör det nu. Hoppas det inte påverkar denna log.../C

 

[log]Logfile of random's system information tool (written by random/random)

Run by Kral at 2008-08-27 18:20:24

Microsoft Windows XP Home Edition Service Pack 2

System drive C: has 31 GB (53%) free of 57 GB

Total RAM: 382 MB (41% free)

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:21:42, on 2008-08-27

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\LightScribe\LSSrvc.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program\Alwil Software\Avast4\ashMaiSv.exe

C:\Program\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program\Synaptics\SynTP\SynTPLpr.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\Program\HP\HP Software Update\HPWuSchd2.exe

C:\Program\QuickTime\qttask.exe

C:\Program\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program\Google\Gmail Notifier\gnotify.exe

C:\Program\DAEMON Tools\daemon.exe

C:\Program\ALWILS~1\Avast4\ashDisp.exe

C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Program\HPQ\SHARED\HPQWMI.exe

C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\3\3Connect\AutoUpdateSrv.exe

C:\Program\Delade filer\Teleca Shared\Generic.exe

C:\Program\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\3\3Connect\Wilog.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Kral\Skrivbord\RSIT.exe

C:\Program\Alwil Software\Avast4\setup\avast.setup

C:\Program\Trend Micro\HijackThis\Kral.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.se/0SESVSE/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=493&clcid=0x041d

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\HPQ\Quick Launch Buttons\EabServr.exe /Start

O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [AutoTBar] C:\Program\HP\Digital Imaging\bin\AUTOTBAR.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')

O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Uppdateringsagent.lnk = ?

O8 - Extra context menu item: &Windows Live Search - res://C:\Program\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Öppna på ny flik i bakgrunden - res://C:\Program\Windows Live Toolbar\Components\sv-se\msntabres.dll.mui/229?7da6ff3935604ba79d92d2946ebc958a

O8 - Extra context menu item: Öppna på ny flik i förgrunden - res://C:\Program\Windows Live Toolbar\Components\sv-se\msntabres.dll.mui/230?7da6ff3935604ba79d92d2946ebc958a

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{D862CA80-FB59-4C04-9E08-43D1F5C3EF22}: NameServer = 80.251.192.244 80.251.192.245

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program\HPQ\SHARED\HPQWMI.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program\Delade filer\LightScribe\LSSrvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

 

--

End of file - 8852 bytes

 

Scheduled tasks folder

 

C:\WINDOWS\tasks\Kontrollera uppdateringar för Windows Live Toolbar.job

 

Registry dump

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader Link Helper - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - C:\Program\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]

Windows Live Toolbar Helper - C:\Program\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]

PDFCreator Toolbar Helper - C:\Program\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll [2006-08-29 757760]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll [2006-08-29 757760]

{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"ATIPTA"=C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-04-11 339968]

"hpWirelessAssistant"=C:\Program\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2005-04-01 794624]

"SynTPLpr"=C:\Program\Synaptics\SynTP\SynTPLpr.exe [2005-02-02 102492]

"SynTPEnh"=C:\Program\Synaptics\SynTP\SynTPEnh.exe [2005-02-02 692316]

"HP Software Update"=C:\Program\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]

"QuickTime Task"=C:\Program\QuickTime\qttask.exe [2007-02-16 282624]

"eabconfg.cpl"=C:\Program\HPQ\Quick Launch Buttons\EabServr.exe [2004-12-03 290816]

"Cpqset"=C:\Program\HPQ\Default Settings\cpqset.exe [2005-02-17 233534]

"LSBWatcher"=c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe [2004-10-14 253952]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]

"DAEMON Tools"=C:\Program\DAEMON Tools\daemon.exe [2005-12-10 133016]

"avast!"=C:\Program\ALWILS~1\Avast4\ashDisp.exe [2008-05-16 79224]

"Adobe Photo Downloader"=C:\Program\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]

"Sony Ericsson PC Suite"=C:\Program\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-02-20 741376]

"AutoTBar"=C:\Program\HP\Digital Imaging\bin\AUTOTBAR.EXE []

"SunJavaUpdateSched"=C:\Program\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"=C:\Program\Messenger\msmsgs.exe /background []

"MsnMsgr"=C:\Program\MSN Messenger\MsnMsgr.Exe /background []

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

 

C:\Documents and Settings\All Users\Start-meny\Program\Autostart

Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

Uppdateringsagent.lnk - C:\Program\3\3Connect\AutoUpdateSrv.exe

 

C:\Documents and Settings\Kral\Start-meny\Program\Autostart

Adobe Gamma.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

C:\WINDOWS\system32\Ati2evxx.dll [2005-04-11 46080]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2006-09-20 441136]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program\Messenger\msmsgs.exe"="C:\Program\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\Program\MSN Messenger\msnmsgr.exe"="C:\Program\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

"C:\Documents and Settings\Kral\Skrivbord\utorrent.exe"="C:\Documents and Settings\Kral\Skrivbord\utorrent.exe:*:Enabled:µTorrent"

"C:\Program\Soulseek\slsk.exe"="C:\Program\Soulseek\slsk.exe:*:Enabled:SoulSeek"

"C:\Program\Mozilla Firefox\firefox.exe"="C:\Program\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"

"C:\Program\Winamp Remote\bin\Orb.exe"="C:\Program\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"

"C:\Program\Winamp Remote\bin\OrbTray.exe"="C:\Program\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"

"C:\Program\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"

"C:\Program\Hp\Digital Imaging\bin\hpqtra08.exe"="C:\Program\Hp\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"

"C:\Program\Hp\Digital Imaging\bin\hpqste08.exe"="C:\Program\Hp\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"

"C:\Program\Hp\Digital Imaging\bin\hpofxm08.exe"="C:\Program\Hp\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"

"C:\Program\Hp\Digital Imaging\bin\hposfx08.exe"="C:\Program\Hp\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"

"C:\Program\Hp\Digital Imaging\bin\hposid01.exe"="C:\Program\Hp\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"

"C:\Program\Hp\Digital Imaging\bin\hpqscnvw.exe"="C:\Program\Hp\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

"C:\Program\Hp\Digital Imaging\bin\hpqkygrp.exe"="C:\Program\Hp\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

"C:\Program\Hp\Digital Imaging\bin\hpqCopy.exe"="C:\Program\Hp\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"

"C:\Program\Hp\Digital Imaging\bin\hpfccopy.exe"="C:\Program\Hp\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"

"C:\Program\Hp\Digital Imaging\bin\hpzwiz01.exe"="C:\Program\Hp\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

"C:\Program\Hp\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program\Hp\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

"C:\Program\Hp\Digital Imaging\Unload\HpqDIA.exe"="C:\Program\Hp\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"

"C:\Program\Hp\Digital Imaging\bin\hpoews01.exe"="C:\Program\Hp\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"

"C:\Program\Hp\Digital Imaging\bin\hpqnrs08.exe"="C:\Program\Hp\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

"C:\Program\Skype\Phone\Skype.exe"="C:\Program\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

"C:\WINDOWS\system32\a.exe"="C:\WINDOWS\system32\a.exe:*:Disabled:a"

"C:\Documents and Settings\Kral\Lokala inställningar\Temp\.tt11.tmp"="C:\Documents and Settings\Kral\Lokala inställningar\Temp\.tt11.tmp:*:Enabled:enable"

"C:\WINDOWS\system32\sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe:*:Enabled:enable"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program\MSN Messenger\msnmsgr.exe"="C:\Program\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

shell\AutoRun\command - E:\AutoRun.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{966bf1bc-4dc8-11dd-8938-00c09ff30817}]

shell\AutoRun\command - E:\AutoRun.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{966bf1bd-4dc8-11dd-8938-00c09ff30817}]

shell\AutoRun\command - E:\AutoRun.exe

 

 

List of files/folders created in the last three months

 

2008-08-27 18:20:24 ----D---- C:\rsit

2008-08-27 12:16:05 ----D---- C:\Program\Trend Micro

2008-08-27 11:32:38 ----D---- C:\WINDOWS\erunt

2008-08-27 11:21:17 ----D---- C:\SDFix

2008-08-21 23:21:08 ----A---- C:\WINDOWS\system32\tdssserf.dll

2008-08-16 03:21:21 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$

2008-08-16 03:21:08 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$

2008-08-16 03:20:51 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$

2008-08-16 03:17:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$

2008-08-16 03:17:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$

2008-08-16 03:15:10 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$

2008-07-30 03:11:52 ----A---- C:\WINDOWS\system32\javaws.exe

2008-07-30 03:11:52 ----A---- C:\WINDOWS\system32\javaw.exe

2008-07-30 03:11:52 ----A---- C:\WINDOWS\system32\java.exe

2008-07-27 00:35:54 ----D---- C:\Documents and Settings\Kral\Application Data\dvdcss

2008-07-23 23:03:11 ----A---- C:\WINDOWS\ModemLog_AC97 Data Fax SoftModem with SmartCP.txt

2008-07-09 17:07:45 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #2.txt

2008-07-09 14:23:31 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$

2008-07-07 18:30:39 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt

2008-07-07 18:29:54 ----D---- C:\Documents and Settings\Kral\Application Data\Birdstep Technology

2008-07-07 18:29:35 ----D---- C:\Documents and Settings\All Users\Application Data\Birdstep Technology

2008-07-07 18:27:46 ----D---- C:\Program\Huawei Modems

2008-07-07 18:27:46 ----D---- C:\Program\3

2008-07-07 18:27:46 ----A---- C:\WINDOWS\Huawei ModemsUninstall.exe

2008-06-24 00:31:57 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$

2008-06-12 20:26:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$

2008-06-12 20:26:28 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$

2008-06-12 20:26:21 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$

2008-06-12 20:26:04 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$

2008-05-29 00:41:11 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$

 

List of drivers

 

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-05-16 26944]

R1 AmdK8;AMD-processordrivrutin; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-08-11 43008]

R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416]

R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-05-16 42912]

R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys []

R1 sdcplh;sdcplh; C:\WINDOWS\System32\drivers\sdcplh.sys [2005-11-24 55168]

R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]

R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560]

R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-05-16 94416]

R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]

R2 mdvrmng;Mobile IP Route Manager; \??\C:\WINDOWS\system32\drivers\mdvrmng.sys []

R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-05-16 23152]

R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-04-11 1035264]

R3 BCM43XX;Drivrutin för Broadcom 802.11 nätverksadapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2005-03-10 371712]

R3 CAMCAUD;Conexant AMC Audio; C:\WINDOWS\system32\drivers\camc6aud.sys [2005-02-18 38016]

R3 CAMCHALA;CAMCHALA; C:\WINDOWS\system32\drivers\camc6hal.sys [2005-02-18 349696]

R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080]

R3 dtscsi;dtscsi; C:\WINDOWS\system32\System32\Drivers\dtscsi.sys []

R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2004-12-15 1038208]

R3 HSFHWATI;HSFHWATI; C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 200192]

R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2007-08-08 101120]

R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-03 74496]

R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2005-02-02 191456]

R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]

R3 usbhub;USB2-aktiverat nav; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]

R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]

R3 USBSTOR;Drivrutin för USB-masslagringsenheter; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2004-12-15 703232]

S3 0d38b602-19a3-42d8-bb40-47c60ef782bc;0d38b602-19a3-42d8-bb40-47c60ef782bc; \??\D:\Player\cds300.dll []

S3 Arp1394;1394 ARP-klientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]

S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-01-18 55320]

S3 catchme;catchme; \??\C:\DOCUME~1\Kral\LOKALA~1\Temp\catchme.sys []

S3 dot4;MS IEEE-1284.4-drivrutin; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2004-08-03 207360]

S3 Dot4Print;Utskriftsklassdrivrutin för IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]

S3 Dot4Scan;Skanningsklassdrivrutin för IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]

S3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-09-06 23936]

S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys []

S3 HidUsb;Microsoft HID-klassdrivrutin; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]

S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]

S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]

S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]

S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys []

S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys []

S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys []

S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys []

S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys []

S3 mouhid;HID-drivrutin för mus; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-09-06 12160]

S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]

S3 pgfilter;pgfilter; \??\C:\Program\PeerGuardian2\pgfilter.sys []

S3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]

S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\WINDOWS\system32\DRIVERS\s616bus.sys [2007-04-03 83208]

S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112]

S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s616mdm.sys [2007-04-03 108680]

S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360]

S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\WINDOWS\system32\DRIVERS\s616nd5.sys [2007-04-03 23176]

S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s616obex.sys [2007-04-03 98568]

S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\WINDOWS\system32\DRIVERS\s616unic.sys [2007-04-03 99080]

S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-04 67584]

S3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-09-06 36425]

S3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-03-16 159488]

S3 usbprint;Microsoft USB-skrivarklass; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]

S3 usbscan;Drivrutin för USB-skanner; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]

S3 w810bus;Sony Ericsson W810 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w810bus.sys []

S3 w810mdfl;Sony Ericsson W810 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w810mdfl.sys []

S3 w810mdm;Sony Ericsson W810 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w810mdm.sys []

S3 w810mgmt;Sony Ericsson W810 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w810mgmt.sys []

S3 w810obex;Sony Ericsson W810 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w810obex.sys []

 

List of services

 

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program\Alwil Software\Avast4\aswUpdSv.exe [2008-05-16 17272]

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-04-11 360448]

R2 avast! Antivirus;avast! Antivirus; C:\Program\Alwil Software\Avast4\ashServ.exe [2008-05-16 144760]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program\Delade filer\LightScribe\LSSrvc.exe [2005-02-22 38912]

R2 MDM;Machine Debug Manager; C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]

R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912]

R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program\Alwil Software\Avast4\ashMaiSv.exe [2008-05-16 247160]

R3 avast! Web Scanner;avast! Web Scanner; C:\Program\Alwil Software\Avast4\ashWebSv.exe [2008-05-16 349560]

R3 hpqwmi;HP WMI Interface; C:\Program\HPQ\SHARED\HPQWMI.exe [2005-03-04 98304]

S3 Adobe LM Service;Adobe LM Service; C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-01-25 72704]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]

S3 ose;Office Source Engine; C:\Program\Delade filer\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]

 

-----------------EOF-----------------

[/log]

 

Link to comment
Share on other sites

Som en riktig newbie på sånt här vet jag inte var jag går för att förbjuda dessa filer i windows-brandväggen. När jag går in på inställningar på brandväggen ser jag dessutom att ett flertal program och filer som jag inte känner igen är markerade som undantag. Vet inte vad göra av detta.

 

Hälsningar

Carl

 

Link to comment
Share on other sites

Kan du någonstans i listan över undantag hitta tt11.tmp och sysrest32.exe?

I så fall bör du väl kunna ta bort dem bara. Jag har inte använt XP-brandväggen så jag kan inga detaljer.

 

Link to comment
Share on other sites

Jag har tagit bort den filen helt nu. Så fort jag markerade den så hojtade avast till.

 

När jag körde avast efteråt så hände ingenting. Betyder det att det är lugnt?

 

Vad gäller brandväggen hittar jag inte filerna ifråga där. Vad kan jag isf göra åt dem?

 

Vänliga hälsningar

Carl

 

[inlägget ändrat 2008-08-27 18:58:49 av crakel]

Link to comment
Share on other sites

Ställ in Utforskaren så att du kan se alla filer:

Verktyg - (Mapp)alternativ eller liknande - Visning

Välj Visa dolda filer och mappar

Avbocka Dölj filnamnstillägg för kända filtyper

Avbocka Dölj skyddade operativsystemfiler

 

Töm mappen C:\\Documents and Settings\\Kral\\Lokala inställningar\\Temp så gott det går och särskilt så ska det inte finnas någon fil tt11.tmp där.

Kolla att filen C:\\WINDOWS\\system32\\sysrest32.exe verkligen är borta.

 

Jag rekommenderar en bättre brandvägg än XPs egna och som du dessutom lägger lite tid på att förstå.

http://ceblstockholm.googlepages.com/home

 

Verkar allt bra med datorn nu?

 

Link to comment
Share on other sites

Har tömpt temp-mappen så när som på dessa filer:

 

~DF2B18.tmp

DataCard_Setup.exe

PromptInfo.exe

ResetDevice.exe

SysConfig.dat

 

Avast! varnade vid borttagandet av ca 3 filer att de var smittade/smittobärare. Dessa raderade jag.

 

Hittar inte heller igen filen i sys32 mappen nu.

 

Avast! hittar ingenting nu när jag kör det, men frågan är hur pålitligt det är just nu, det verkar ju ha missat flera filer eftersom det låg kvar vissa i temp-mappen som det aldrig reagerade på förrän jag rörde i dem... Men: verkar bra med andra ord - kan jag känna mig lugn(are)?

 

Har du något särskilt tips på virusskydd som vore bättre?

 

Ska kolla upp brandväggen du tipsade om nu också!

 

MVH

carl

 

Link to comment
Share on other sites

Surfa till http://www.virustotal.com , bläddra fram en av de tre exe-filerna i temp-mappen, tryck på Skicka Fil och vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in resultatet från de olika antivirusprogrammen (inte Övrig information) här. Upprepa med de andra två filerna.

 

Det var en typ av skadlig fil som kallas för rootkit, för att det gräver in sig i rötterna av Windows och då lyckas dölja sig själv. Det är nog därför som Avast tidigare inte kunde se de skadliga filerna.

 

Link to comment
Share on other sites

Allihop, så vi får reda på om någon/några av dem är infekterade och ska bort.

Jag tittar på resultatet imorgon.

 

Link to comment
Share on other sites

DataCard_Setup.exe

[log]Antivirus Version Senaste Uppdatering Resultat

AhnLab-V3 2008.8.27.1 2008.08.28 -

AntiVir 7.8.1.23 2008.08.28 -

Authentium 5.1.0.4 2008.08.28 -

Avast 4.8.1195.0 2008.08.27 -

AVG 8.0.0.161 2008.08.27 -

BitDefender 7.2 2008.08.28 -

CAT-QuickHeal 9.50 2008.08.26 -

ClamAV 0.93.1 2008.08.28 -

DrWeb 4.44.0.09170 2008.08.28 -

eSafe 7.0.17.0 2008.08.27 -

eTrust-Vet 31.6.6052 2008.08.27 -

Ewido 4.0 2008.08.27 -

F-Prot 4.4.4.56 2008.08.28 -

F-Secure 7.60.13501.0 2008.08.28 -

Fortinet 3.14.0.0 2008.08.28 -

GData 19 2008.08.28 -

Ikarus T3.1.1.34.0 2008.08.28 -

K7AntiVirus 7.10.428 2008.08.25 -

Kaspersky 7.0.0.125 2008.08.28 -

McAfee 5371 2008.08.27 -

Microsoft 1.3807 2008.08.25 -

NOD32v2 3394 2008.08.27 -

Norman 5.80.02 2008.08.27 -

Panda 9.0.0.4 2008.08.27 -

PCTools 4.4.2.0 2008.08.27 -

Prevx1 V2 2008.08.28 -

Rising 20.59.30.00 2008.08.28 -

Sophos 4.33.0 2008.08.28 -

Sunbelt 3.1.1582.1 2008.08.26 -

Symantec 10 2008.08.28 -

TheHacker 6.3.0.6.064 2008.08.27 -

TrendMicro 8.700.0.1004 2008.08.28 -

VBA32 3.12.8.4 2008.08.28 -

ViRobot 2008.8.27.1352 2008.08.27 -

VirusBuster 4.5.11.0 2008.08.27 -

Webwasher-Gateway 6.6.2 2008.08.28 -[/log]

 

PromptInfo.exe

[log]Antivirus Version Senaste Uppdatering Resultat

AhnLab-V3 2008.8.27.1 2008.08.28 -

AntiVir 7.8.1.23 2008.08.28 -

Authentium 5.1.0.4 2008.08.28 -

Avast 4.8.1195.0 2008.08.27 -

AVG 8.0.0.161 2008.08.27 -

BitDefender 7.2 2008.08.28 -

CAT-QuickHeal 9.50 2008.08.26 -

ClamAV 0.93.1 2008.08.28 -

DrWeb 4.44.0.09170 2008.08.28 -

eSafe 7.0.17.0 2008.08.27 -

eTrust-Vet 31.6.6052 2008.08.27 -

Ewido 4.0 2008.08.27 -

F-Prot 4.4.4.56 2008.08.28 -

F-Secure 7.60.13501.0 2008.08.28 -

Fortinet 3.14.0.0 2008.08.28 -

GData 19 2008.08.28 -

Ikarus T3.1.1.34.0 2008.08.28 -

K7AntiVirus 7.10.428 2008.08.25 -

Kaspersky 7.0.0.125 2008.08.28 -

McAfee 5371 2008.08.27 -

Microsoft 1.3807 2008.08.25 -

NOD32v2 3395 2008.08.28 -

Norman 5.80.02 2008.08.27 -

Panda 9.0.0.4 2008.08.27 -

PCTools 4.4.2.0 2008.08.27 -

Prevx1 V2 2008.08.28 -

Rising 20.59.30.00 2008.08.28 -

Sophos 4.33.0 2008.08.28 -

Sunbelt 3.1.1582.1 2008.08.26 -

Symantec 10 2008.08.28 -

TheHacker 6.3.0.6.064 2008.08.27 -

TrendMicro 8.700.0.1004 2008.08.28 -

VBA32 3.12.8.4 2008.08.28 -

ViRobot 2008.8.27.1352 2008.08.27 -

VirusBuster 4.5.11.0 2008.08.27 -

Webwasher-Gateway 6.6.2 2008.08.28 -[/log]

 

ResetDevice.exe: När jag skulle analysera denna hävdade virustotal att filen redan var analyserad, trots att jag inte analyserat den tidigare, och när jag valde analysera på nytt hamnade den i kö. Annars fungerade allt som det skulle.

[log]Antivirus Version Senaste Uppdatering Resultat

AhnLab-V3 2008.8.27.1 2008.08.28 -

AntiVir 7.8.1.23 2008.08.28 -

Authentium 5.1.0.4 2008.08.28 -

Avast 4.8.1195.0 2008.08.27 -

AVG 8.0.0.161 2008.08.27 -

BitDefender 7.2 2008.08.28 -

CAT-QuickHeal 9.50 2008.08.26 -

ClamAV 0.93.1 2008.08.28 -

DrWeb 4.44.0.09170 2008.08.28 -

eSafe 7.0.17.0 2008.08.27 -

eTrust-Vet 31.6.6052 2008.08.27 -

Ewido 4.0 2008.08.27 -

F-Prot 4.4.4.56 2008.08.28 -

F-Secure 7.60.13501.0 2008.08.28 -

Fortinet 3.14.0.0 2008.08.28 -

GData 19 2008.08.28 -

Ikarus T3.1.1.34.0 2008.08.28 -

K7AntiVirus 7.10.428 2008.08.25 -

Kaspersky 7.0.0.125 2008.08.28 -

McAfee 5371 2008.08.27 -

Microsoft 1.3807 2008.08.25 -

NOD32v2 3395 2008.08.28 -

Norman 5.80.02 2008.08.28 -

Panda 9.0.0.4 2008.08.27 -

PCTools 4.4.2.0 2008.08.27 -

Prevx1 V2 2008.08.28 -

Rising 20.59.30.00 2008.08.28 -

Sophos 4.33.0 2008.08.28 -

Sunbelt 3.1.1582.1 2008.08.26 -

Symantec 10 2008.08.28 -

TheHacker 6.3.0.6.064 2008.08.27 -

TrendMicro 8.700.0.1004 2008.08.28 -

ViRobot 2008.8.27.1352 2008.08.27 -

VirusBuster 4.5.11.0 2008.08.27 -

Webwasher-Gateway 6.6.2 2008.08.28 -[/log]

 

Link to comment
Share on other sites

När jag skulle analysera denna hävdade virustotal att filen redan var analyserad, trots att jag inte analyserat den tidigare
Meddelandet betyder att någon har skannat filen förut, inte att du har gjort det.

 

Vet du vad det är för filer? För det är inte normalt att det ligger exe-filer i tmp-mappen som inte går att ta bort. Kolla i filernas egenskaper vad det är för datum och om det går att knyta dem till något företag eller produkt.

 

 

 

Link to comment
Share on other sites

Datacard_setup.exe: Copyright © Huawei Technologies Co., Ltd. 2004-2006. All rights reserved.

 

Promptinfo.exe: Copyright © 2007=inget företag ligger bakom vad jag kan se i egenskaper.

 

ResetDevice.exe: här finns inte ens fliken "version" på egenskaper, så jag kan inte se var den kommer ifrån...

 

Link to comment
Share on other sites

Och datum (skapad, ändrad, använd);

 

DataCard: 7/7-08, 15/10-07, 28/8-08

Promptinfo: 7/7-08, 13/10-07, 28/8-08

ResetDevice: 7/7-08, 25/7-08, 28/8-08

 

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.



×
×
  • Create New...